4 ms·

>I personally prefer the "security" of content blockers vs. extensions This is why content blockers are actually better, extensions are huge security holes. S

>I personally prefer the "security" of content blockers vs. extensions This is why content blockers are actually better, extensions are huge security holes. Setting aside the whole issue of content v ad blocking, anything that locks down the capabilities of extensions on your system is only a plus for your security.

close04 7y ago
Why not have a content blocker with much higher limits? If security is the aim why the limit for 50000 filter rules in use at one time?
- xodice 7y ago
  I've yet to see a iOS or macOS content blocker that doesn't use multiple filter rules to bypass the 50k limit.
  - danShumway 7y ago
    I'm not sure I understand. If everybody can bypass the 50k limit, what's the point of the limit? If the 50k limit isn't sufficiently high, I don't think, "they're trying to restrict blockers, but don't worry they're bad at it" is a great defense. And if the 50k limit is high enough, and it's a reasonable tradeoff between privacy and performance, then why are content blockers putting in extra work to bypass it? Should we expect that Apple will block the limit workaround in the future?
    - hombre_fatal 7y ago
      One guess: Without a limit, developers would probably default to a massive append-only list that takes a minute to compile. With a limit, developers have to shard their rules which lets them at least compile them in parallel. For example, you need to recompile the list if you want to support on-the-fly customizations like "whitelist this site."
  - buran77 7y ago
    > bypass the 50k limit > when Apple rolled out the new Content Blocker API, it enforced a maximum limit of 50,000 rules for each new extension that wanted to block content inside Safari. Check again? You're probably thinking of how classic extensions used to work.
- nordsieck 7y ago
  > why the limit for 50000 filter rules in use at one time? Eventually more rules will cause a performance impact.
  - close04 7y ago
    Put a disclaimer/warning and let the user decide whether the trade-off is worth it. Ads tend to have far higher performance and power consumption impact than this. Do Safari or Chrome force downscaled pictures and videos on you because it's faster? How is any other software "limited" for performance? And if this is a performance issue then why a fixed limit instead of one that varies with your system's performance? Edit. HN is "hinting" at me that a developer setting arbitrarily low limits "for performance" and not allowing a change is reasonable and expected. Strange place to be told that manufacturer defaults are sacred and the "advanced settings" checkbox should be abolished. For performance, stability, all that. :)
  - glogla 7y ago
    They can't possibly cause as much performance impact as allowing ads through.
  - buran77 7y ago
    So do tabs and I can still open 500 (maybe more already) on a 4 year old phone. No scenario I can imagine relies on having so many tabs open at once. The 50000 rules limit is far more crippling to blockers since you need those rules at once.
    - stjohnswarts 7y ago
      Hint: Those tabs aren't really tabs, they're pretty much just text links, they are not loaded into memory. 99% of them NOT running. If all 500 of those tabs ran in parallel you wouldn't be able to use your phone.
- saagarjha 7y ago
  It’s kept low for performance. I wonder if they’ll revisit the limit at some point.
  - quotemstr 7y ago
    What performance? Build a DDA out of the union of all the patterns and run it over each URL. Now you have O(1) (with low constant factors) matching no matter how many patterns you have. The DFA itself takes space and memory dereferences aren't free either, but even huge DFAs can be very compact.
    - saagarjha 7y ago
      They do build a DFA of the rules.
  - buran77 7y ago
    Then why enforce the same limit for the iPhone 6s and a top of the line (i)Mac Pro? The elegant solution would be to start with a sensible preset for your device, allow you to change it if you want, and then warn you if some noticeable delays are detected. IE used to do this with addon loading.
tomc1985 7y ago
Nobody cares about extensibility any more :( "This is what's good for you, and you're going to like it!" I hate computing nowadays.
- pilsetnieks 7y ago
  Of the scales between freedom and security have tipped more to the security side. In a way, I mourn the lost freedom, but on the other hand, the increasing scale and sophistication of bad actors make me want for more security. Yes, I know about old Ben's "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety" but in tech there are amplifying factors that can simply overwhelm even the most staunch defender of liberty. At this point you have to give up most uses of technology that have become socially ingrained, if you want to remain secure, yet have complete freedom about your tech. A lifestyle like RMS does not seem appealing to very many people. A "caveat emptor" argument simply does not work with tech. No one can fully examine every piece of hardware and software, and determine it's secure, or find trusted and competent sources to vouch for everything with certainty. Even then, eventually tricky issues arise in time where subtle bugs can be exploited. By the time there's something for the emptor to caveat, their data has long still been stolen and compromised.
  - stjohnswarts 7y ago
    Your scenario fails because there's no reason you can't have both. No one forces anyone to install extensions. Apple could make it available to turn off and use a custom extension without much ado. Instead they act like authoritarians.
javagram 7y ago
That logic, taken to its rational conclusion, means you shouldn’t be able to run any executable on your computer unless it’s been pre-approved by your OS manufacturer. And yes, that would be a plus for security - and a negative for user freedom.
- scarface74 7y ago
  “Users” don’t care about the type of “freedom” that geeks care about. In fact, I like having the freedom to install any random crap on my iOS devices knowing that it is limited by both the sandbox and the permissions that I give it. Which is different than any desktop OS.
  - javagram 7y ago
    You can have the same “freedom” on Mac by going into system preferences and turning on the option to only allow App Store apps to run. It should remain an option, not a forced choice. (As long as Firefox still exists and can run on desktops, there will still be a choice... but it’s still unfortunate and a disturbing trend to see more companies making moves against user freedom on their PCs.)
    - scarface74 7y ago
      Until you need to install something like Zoom - which is suppose to be reputable - and it installs a web server that reinstalls itself if you uninstall it.

close04 7y ago

Why not have a content blocker with much higher limits? If security is the aim why the limit for 50000 filter rules in use at one time?

xodice 7y ago
I've yet to see a iOS or macOS content blocker that doesn't use multiple filter rules to bypass the 50k limit.
- danShumway 7y ago
  I'm not sure I understand. If everybody can bypass the 50k limit, what's the point of the limit? If the 50k limit isn't sufficiently high, I don't think, "they're trying to restrict blockers, but don't worry they're bad at it" is a great defense. And if the 50k limit is high enough, and it's a reasonable tradeoff between privacy and performance, then why are content blockers putting in extra work to bypass it? Should we expect that Apple will block the limit workaround in the future?
  - hombre_fatal 7y ago
    One guess: Without a limit, developers would probably default to a massive append-only list that takes a minute to compile. With a limit, developers have to shard their rules which lets them at least compile them in parallel. For example, you need to recompile the list if you want to support on-the-fly customizations like "whitelist this site."
- buran77 7y ago
  > bypass the 50k limit > when Apple rolled out the new Content Blocker API, it enforced a maximum limit of 50,000 rules for each new extension that wanted to block content inside Safari. Check again? You're probably thinking of how classic extensions used to work.
nordsieck 7y ago
> why the limit for 50000 filter rules in use at one time? Eventually more rules will cause a performance impact.
- close04 7y ago
  Put a disclaimer/warning and let the user decide whether the trade-off is worth it. Ads tend to have far higher performance and power consumption impact than this. Do Safari or Chrome force downscaled pictures and videos on you because it's faster? How is any other software "limited" for performance? And if this is a performance issue then why a fixed limit instead of one that varies with your system's performance? Edit. HN is "hinting" at me that a developer setting arbitrarily low limits "for performance" and not allowing a change is reasonable and expected. Strange place to be told that manufacturer defaults are sacred and the "advanced settings" checkbox should be abolished. For performance, stability, all that. :)
- glogla 7y ago
  They can't possibly cause as much performance impact as allowing ads through.
- buran77 7y ago
  So do tabs and I can still open 500 (maybe more already) on a 4 year old phone. No scenario I can imagine relies on having so many tabs open at once. The 50000 rules limit is far more crippling to blockers since you need those rules at once.
  - stjohnswarts 7y ago
    Hint: Those tabs aren't really tabs, they're pretty much just text links, they are not loaded into memory. 99% of them NOT running. If all 500 of those tabs ran in parallel you wouldn't be able to use your phone.
saagarjha 7y ago
It’s kept low for performance. I wonder if they’ll revisit the limit at some point.
- quotemstr 7y ago
  What performance? Build a DDA out of the union of all the patterns and run it over each URL. Now you have O(1) (with low constant factors) matching no matter how many patterns you have. The DFA itself takes space and memory dereferences aren't free either, but even huge DFAs can be very compact.
  - saagarjha 7y ago
    They do build a DFA of the rules.
- buran77 7y ago
  Then why enforce the same limit for the iPhone 6s and a top of the line (i)Mac Pro? The elegant solution would be to start with a sensible preset for your device, allow you to change it if you want, and then warn you if some noticeable delays are detected. IE used to do this with addon loading.

tomc1985 7y ago

Nobody cares about extensibility any more :( "This is what's good for you, and you're going to like it!" I hate computing nowadays.

pilsetnieks 7y ago
Of the scales between freedom and security have tipped more to the security side. In a way, I mourn the lost freedom, but on the other hand, the increasing scale and sophistication of bad actors make me want for more security. Yes, I know about old Ben's "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety" but in tech there are amplifying factors that can simply overwhelm even the most staunch defender of liberty. At this point you have to give up most uses of technology that have become socially ingrained, if you want to remain secure, yet have complete freedom about your tech. A lifestyle like RMS does not seem appealing to very many people. A "caveat emptor" argument simply does not work with tech. No one can fully examine every piece of hardware and software, and determine it's secure, or find trusted and competent sources to vouch for everything with certainty. Even then, eventually tricky issues arise in time where subtle bugs can be exploited. By the time there's something for the emptor to caveat, their data has long still been stolen and compromised.
- stjohnswarts 7y ago
  Your scenario fails because there's no reason you can't have both. No one forces anyone to install extensions. Apple could make it available to turn off and use a custom extension without much ado. Instead they act like authoritarians.

javagram 7y ago

That logic, taken to its rational conclusion, means you shouldn’t be able to run any executable on your computer unless it’s been pre-approved by your OS manufacturer. And yes, that would be a plus for security - and a negative for user freedom.

scarface74 7y ago
“Users” don’t care about the type of “freedom” that geeks care about. In fact, I like having the freedom to install any random crap on my iOS devices knowing that it is limited by both the sandbox and the permissions that I give it. Which is different than any desktop OS.
- javagram 7y ago
  You can have the same “freedom” on Mac by going into system preferences and turning on the option to only allow App Store apps to run. It should remain an option, not a forced choice. (As long as Firefox still exists and can run on desktops, there will still be a choice... but it’s still unfortunate and a disturbing trend to see more companies making moves against user freedom on their PCs.)
  - scarface74 7y ago
    Until you need to install something like Zoom - which is suppose to be reputable - and it installs a web server that reinstalls itself if you uninstall it.